Threats tagged 'ghsa-8cqm-xp6w-w8hf'

The WP Compress plugin for WordPress up to version 7.22.01 suffers from an authorization bypass vulnerability. This flaw allows unauthenticated attackers to link a victim site to an attacker-controlled WP Compress account and overwrite plugin settings. The vulnerability arises because the plugin does not properly verify user authorization when no api_key is stored, affecting fresh or lite/free-mode installations. Exploitation can lead to full control over privileged plugin operations such as cache purging and file deletion.